Privacy Policy

Last updated: 28 September 2026

This page explains what personal data this website collects, why, and what your rights are. It covers the website and the contact form. If we go on to work together, you will receive a separate privacy notice explaining how I look after your therapy records.

Who is responsible for your data

Serafeim Papakostas, CBT psychotherapist, is the data controller for this website. For any question about your data, please use the contact form.

What I collect, and why

When you use the contact form, I receive your name, email address, preferred language and your message. I use them only to reply to you and to arrange an assessment if you would like one.

Your message may include information about your health or other sensitive matters. You don’t have to share this before we speak, and you can keep your first message as brief as you like. If you choose to include it, I use it only to understand your enquiry and respond to it.

The legal basis is taking steps, at your request, before we agree to work together (UK GDPR and EU GDPR, Article 6(1)(b)). For health information you include, it is your explicit consent (Article 9(2)(a)), which you can withdraw at any time by asking me to delete your message.

When you visit the site, the server records technical information such as your IP address, browser type and the pages requested. This is needed to deliver the site and keep it secure (legitimate interests, Article 6(1)(f)). These logs are kept for a short period and are not used to identify you.

To see how the site is used, I use Umami, a privacy-friendly analytics tool run on a private server rather than by an advertising company. It counts page views and records the page, the referring website, the browser, device type and country. It sets no cookies, doesn’t store your IP address, and doesn’t follow you across other sites or build a profile of you. The results are only ever seen as totals (legitimate interests, Article 6(1)(f)).

Cookies

The site sets no analytics, advertising or tracking cookies. If you pick a language with the EN / ΕΛ switch, your browser remembers that choice on your device. It is never sent to me. Cloudflare, which helps deliver and protect the site, may set a strictly necessary security cookie.

Who else handles your data

I don’t sell your data or share it for marketing. A few service providers process it on my behalf, only as needed to run the site:

• the hosting provider, whose server in a London (UK) data centre runs both the site and the Umami analytics;
• Cloudflare, which delivers and protects the site;
• my email provider, which delivers contact-form messages to my inbox.

Some of these providers may process data outside the UK and the EEA. Where they do, the transfer is protected by an adequacy decision or by standard contractual clauses.

How long I keep it

If your enquiry doesn’t lead to therapy, I delete your message and contact details within 12 months of our last contact. If we start working together, your details become part of your client record, which is covered by the separate notice mentioned above.

Your rights

You can ask me to give you a copy of your personal data, correct it, delete it, restrict or object to how I use it, or send it to you in a portable form. To do any of these, use the contact form. I will reply within one month.

You can also complain to a data-protection authority: in the UK, the Information Commissioner’s Office; in Greece, the Hellenic Data Protection Authority; or the authority in the country where you live.

Changes

I may update this page from time to time. The date at the top shows when it last changed.